CVE-2026-65665

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe" or InitiatingProcessFileName =~ "OWSTIMER.exe" // SharePoint worker processes
| where FileName !in ("cmd.exe", "powershell.exe", "pwsh.exe") // Filter common legitimate shells if not expected
| where ProcessCommandLine has_any ("-c", "/c", "-EncodedCommand", "Invoke-Expression", "IEX", "Start-Process") // Common RCE indicators
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| join kind=leftouter (
    DeviceNetworkEvents
    | where InitiatingProcessFileName =~ "w3wp.exe" or InitiatingProcessFileName =~ "OWSTIMER.exe"
    | where RemoteIP !in ("127.0.0.1", "0.0.0.0") and RemoteIP !startswith "10." and RemoteIP !startswith "172.16." and RemoteIP !startswith "192.168."
    | summarize make_set(RemoteIP) by DeviceName, InitiatingProcessFileName
) on DeviceName, InitiatingProcessFileName
| extend RemoteIPs = set_RemoteIP

Splunk SPL

index=* (sourcetype=ms:security:event:4688 OR sourcetype=ms:security:event:4690) (ParentProcessName="w3wp.exe" OR ParentProcessName="OWSTIMER.exe")
| eval CommandLine=coalesce(NewProcessCommandLine, CommandLine)
| search CommandLine IN ("*-c*", "*/c*", "*-EncodedCommand*", "*Invoke-Expression*", "*IEX*", "*Start-Process*")
| search NOT (NewProcessName IN ("cmd.exe", "powershell.exe", "pwsh.exe"))
| join type=left (
    index=* sourcetype=ms:security:event:5156 (ProcessName="w3wp.exe" OR ProcessName="OWSTIMER.exe")
    | search NOT (dest_ip IN ("127.0.0.1", "0.0.0.0", "10.*", "172.16.*", "192.168.*"))
    | stats values(dest_ip) as RemoteIPs by host, ProcessName
)
| table _time, host, ParentProcessName, NewProcessName, CommandLine, RemoteIPs

Sigma

title: SharePoint Deserialization RCE Attempt
id: 5a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential remote code execution via deserialization vulnerability in Microsoft SharePoint by monitoring unusual process creation or network connections from SharePoint worker processes.
references:
  - https://blog.talosintelligence.com/microsoft-patch-tuesday-for-august-2026/
author: SecBoard Operations
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
tags:
  - attack.execution
  - attack.t1203
  - cve.2026.65665
  - exploitation
detection:
  selection_parent_process:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\OWSTIMER.exe'
  selection_command_line:
    CommandLine|contains:
      - '-c'
      - '/c'
      - '-EncodedCommand'
      - 'Invoke-Expression'
      - 'IEX'
      - 'Start-Process'
  filter_legitimate_shells:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent_process and selection_command_line and not filter_legitimate_shells
falsepositives:
  - Legitimate administrative scripts executed by SharePoint processes, requires careful tuning.
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start"
| where process.parent.executable in ("w3wp.exe", "OWSTIMER.exe")
| where process.command_line : ("*-c*", "*/c*", "*-EncodedCommand*", "*Invoke-Expression*", "*IEX*", "*Start-Process*")
| where not process.executable in ("cmd.exe", "powershell.exe", "pwsh.exe")
| join kind=left outer (
    from network where event.category == "network" and event.type == "connection"
    | where process.executable in ("w3wp.exe", "OWSTIMER.exe")
    | where not destination.ip in ("127.0.0.1", "0.0.0.0") and not destination.ip.is_private
    | summarize remote_ips = array_agg(destination.ip) by host.name, process.executable
) on host.name = host.name and process.executable = process.executable
| select @timestamp, host.name, process.parent.executable, process.executable, process.command_line, remote_ips